2254d625ca4e9074ac88199d91e78de8fc6979e6850674c409624c765bda7092

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 21:06

Target

Modules/ists.dll
Size

269KB
MD5

78bed877a9d9564205e98359650a9246
SHA1

e4bd50f48bdc9260e36bfd2731d8d85de162bfbc
SHA256

a2ec95353203228e798a685de97f04ac27cf9561907b559bf8f252c9425ee817
SHA512

267d2c9461432d8da70a65b64238680c30fe577f31e6960e9b32c9f55bf63ad0893164c521b0e3d6ec8dc21fcf206adc9f27529514960861c2fae928669138f4
SSDEEP

3072:pAIj6X3k1npXjKT0p9JO1X8gD49pWLUkfXwVac1+3owWiqG3IN3VXRESp9SXk:pAo6EFNju0dsFMCUko7ieRvp9x

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2964	2156	rundll32.exe	28
PID 2156 wrote to memory of 2964	2156	rundll32.exe	28
PID 2156 wrote to memory of 2964	2156	rundll32.exe	28
PID 2156 wrote to memory of 2964	2156	rundll32.exe	28
PID 2156 wrote to memory of 2964	2156	rundll32.exe	28
PID 2156 wrote to memory of 2964	2156	rundll32.exe	28
PID 2156 wrote to memory of 2964	2156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\ists.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\ists.dll,#1
  2⤵
  PID:2964